NEAS[.]c316c6413576f0b03a7548710c34ad70[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c316c6413576f0b03a7548710c34ad70.exe
Size

5KB
MD5

c316c6413576f0b03a7548710c34ad70
SHA1

2ea318c0650c5edcdbd16f40a17f1e93d73520ce
SHA256

f073c03f3ea57e10c1c7362da09a21bef288e15faccdc760eba8eb22e43915b0
SHA512

2bdfc9b4d3e560dbb0f0db3cf401c7f9a3d76e952713feffb6b3e8ba2eeeb78885f1a4761ab71ef87032cd3084de5a57d66d777b64a4d03ad8bfd0a8ccc31781
SSDEEP

96:NtHPdX4uMmkQiOE4LO3TrBL50zBM2MYorW:vVXaQiWLO4bBorW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c316c6413576f0b03a7548710c34ad70.exe

Files

NEAS.c316c6413576f0b03a7548710c34ad70.exe
.exe windows:4 windows x64

5260e51a19b83727c52ee1ec7b0d7971

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LocalAlloc
GetSystemTime
Sleep
ExpandEnvironmentStringsA

msvcrt

memmove
printf
system
_vsnprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

urlmon

URLDownloadToFileA

snmpapi

SnmpUtilOctetsCpy
SnmpUtilOctetsFree
SnmpUtilOidAppend
SnmpUtilVarBindCpy
SnmpUtilOidFree
SnmpUtilPrintAsnAny
SnmpSvcGetUptime
SnmpUtilOidNCmp

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ